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REMARKS 

I. INTRODUCTION 

In response to the Office Action dated Match 25, 2004, please consider the foUowing 
remarks. 

II. STATUS OF CLAIMS 

Qaims 1-23 are pending in the application. 

Claims 1-23 were rejected under 35 U.S.C. §l02(e) as being anticipated by Rallis, U.S. Patent 
No, 6,21 6,230 (liexeinafter Rallis, or dae Rallis reference). 

ni. STATUS OF AMENDMENTS 

No amendments to the claims have been made subsequent to the final Office Action. 

IV. ISSUES PRESENTED FOR REVIEW 

Whether claims 1-23 axe patentable under 35 U.S>C* § 102(e) over U-S. Patent No. 6,216^30, 
issued to Rallis (hereinaftei;, the Rallis reference). 

V. GROUPING OF CLAIMS 

The rejected claims do not stand or fall together. Each claim is independently patentable. 
Separate arguments for the patentability of each claim are provided below, 

VI. ARGUMENTS 

A. The Independent Claims Are Patentable Over The Prior Art 
1. The Rallis Reference 

U.S. Patent No. 6,216,230, issued April 10, 2001 to Rallis et aL discloses a notebook security 
system (NBS) that prevents unauthorized use of a computer. A program resident on the computer 
and implements a uset-validarion procedure. A key device carries a first scxial number and an 
encryption key. A second serial number i$ stored in said computer, the second serial number being 
the serial mimber of a device internal to die computer. A mass storage device installed in said 
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computer stor s a validation xecoid. The validation record comprises an unencrypted portion and an 
encrypted portion, the unencrypted pozrion including a copy of said first serial number and said 
encrypted portion including a copy o£ said second serial number and a user personal identification 
number. The key device is interfaced to the computer. The first serial nurober and the encryption 
key are read from said key device in order to gain authorized use of said computer. The key device 
may be removed fi:om the computet after authorized use of the computer has been gained, and 
during operation of the computer. 

2. Differences Between the Rallis Reference and the Applicants* Invention 

The Rallis reference does not disclose a system for securing a token fi:om unauthorized use. 
Instead, Rallis teaches the use of a token to prevent imauthorized use of a notebook computer. To 
achieve this aim, the Rallis reference discloses a system wherein the PIN is entered by a 
conventional keyboard coupled to a host computer, not by a device coupled between a token and 
the host computer, as descnbed in the Applicants' invention. RalUs also does not disclose 
intercepting PIN commands from the host computer ... in fact, no message having a PIN is ever 
sent to the key. The only message sent to the key is a "super key" which is stored in the computer 
(BIOS), not something that the user entered. 

The Final Office Action disagrees, staring: 

Although the Rallis reference does disclose preventing an unauthotised user to use a 
computer. Rallis also discloses that the key device (20) is used in conjunction with the 
computer to validate the user to perform operations (see coL 2, lines 45-67). 

However, whether the Rallis reference discloses a key device "used in conjunction with a 
compute.! to validate the user to perform operations" is not the issue . . . the issue is whether Rallis 
teaches a system for preventing unauthorized use of a token. Simple examination of the RaUis 
reference reveals that it does not. 

3. Independent Claim 1 is Patentable Over the Rallis Reference 
Claim 1 recites: 
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ncemng a firsf- mtssage transmitted from a host processing device and addnsssed to a PIN antry 
device aecording to a unmrsal smal bus (USB) protocol; 

accepting a PIN entmd into the PIN entry device; and 

irunsmitting a second message cmprising at /east a porHon of the first message and the PIN from 
the PIN entry device to the token along a secure communicaUon path. 

The First Office Action indicated that the RoUis reference disclosed the step of ^Yeceiving a 

first message transmitted from a host processing demce and addressed to a PIN entry device according to a universal 

serial bus (USB) protocoP' as follows: 

A pxogrsim that is automatically invoked at compuier power-up, or xeset, implcmenis the user-validatton 
procedute. TLd u»cr is prompted to coimcci the key device to the computer. In the ptefencd embodiment, the 
user is prompted to enter a PIN, although the fiytitem can be configured to opccatc without manual PIN entry, 
(coll. lines 49-54) 

The Applicants respectfully disagreed, poinring oat that the foregoing teaches that the user 
connects the key to the notebook computer and enters a PIN into the notebook computer. 
Accordingly, there is no *TIN entty device** except perhaps the "notebook computer" which cannot 
be connected to itself via a USB protocol* as recited in claim 1. 
In finally rejecting the Applicants' claims, the Examiner disagreed, arguing: 

**Rallis discloses this because a user is prompted to connect a key device (20) to the 
computer and the user ttanstnits a pin to the notebook computer via die usb protocol." 

Of course, even if the foregoing were nrue, this wordsmidied version of cIqityi 1 does not 
address the issue at hand, that is, whether die foregoing discloses **r^ceiving a first message transmitted 
from a host processing device and addressed to a PIN entry device according to a universal serial bus (USB) protocol 
Plainly, it does not. 

In arguing that the Rallis reference discloses *^recezving a first message transmitted from a host 
processing device and addressed to a PIN entry device according to a universal serial bus (USB) protocol" the Final 
Of6ce Action relies on the foregoing passage (col. 1, lines 49-54), FIG. lA (reproduced below), and 
the following text. 
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FIG.1A 



FIG. 1 A shows a key defvice 20 connected to a notebook computer 10- The key device 20, shown in FIG- IB, 
has no external conccols and k comprised of a microcomputer 22^ a rcad-only-mcmoTy 24 and a connector 26. 
The connectox 26 may attach to one of the I/O ports on the notebook computer 10. The preferred key device 
connection is via a FS-2 connector 12, although alternative connections, such as a Universal Serial Bus (USB) 
14 and an In£ca-]^ed (tR) pprt 16, cati bo used as described below. Although the security system has been 
designed for use with a notebook computer 10, it will be recognized that the system can be adapted for use 
with other computers, such as a desktops or Personal Digital Assistants (PDA), (col. 2, lines 35-47) 

Qeady, nothing in FIG. 1 A and in tbe above text discloses '^cmving a first mwagt transmin^d 
from a host processing device and addressed to a PIN entry device according to a universal serial bus (USBJ protocol" 
as recited in claim 1. 

The Fitst 0£Ece Action also indicated that the Ralhs reference discloses the step of 
"transmfiing a second message comprising at least a portion of tbe first message and the PIN from the PIN entry 
device to the token along a secure communication path" ^ follows: 

The procedure permits entry past a first security levd only if the key device sciial number matches the 
unencrypted numbers in the validation record. If the first-level validation is successful^ the procedure then uses 
the encryption key to decrypt the hard drive serial number and PIN found in the stored vahdation record, (col 
1, lines 54-59) 

The Applicants responded by pointing out that the foregoing does not disclose transmitting 
a second message comprising a PN from a PIN entry device to a token. Rallis teaches a system 
wherein the PIN is entered into the notebook computer and nsed fox further processing. It is not 
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transmitted anywhere, let alone vm from a PIN entxy device to a token. In the Final Office 
Action^ the Examiner disagreed, staring: 

"The Exaininer disagrees that Pin is transmitted in second message, because Rallis discloses 
messages are transmitted to and from die key device (20) and the notebook computer (see 
col. 2, lines 48-60)'^ 

Of course, the issue isn't whether messages are transmitted between the host computer and 

the key, but whether Rallis discloses "trammitHng a second message campnsing at least a poison of the first 

mssaff and the PIN Jhm the PIN entry dmce to the token along a secure comnmmcaiion path^\ The passage 

relied upon is reproduced below: 

Ideally, the key device 20 is of such shape and size as ro be placed on the iwcr's key chain. It teceives powex 
and coxximand messages from the notebook computer 10 and rcnims response mess&ges, a fien^ number and 
an encryption key. A program runnmg on the notebook computer 10 uses the key device serial number and the 
encryption key, along Ayidi a Personal Identification Number {PIN)^ in a user-validaiion procedure to prevent 
opexation (J,c. power^up) of the note book computer 10 by an unaudio£i2ed us^. For maximum security 
protection, the key device 20 is comiected only during the user-validation procedure and is carried and stored 
separately from the notebook computer 10. (coL 2, Hues 48-60} 

While the foregoing may disclose message transmission, it does not disclose 'Hransmitdng a 
second message comprising at least a portion of the first message and the PIN from the PIN entry device to the token 
along a secttre communicaHon path^\ as claim 1 requires. 

Finally^ Rallis discloses an embodiment in which the keyboard is separate &om the host 
computer. That embodiment is shown below in a modified version of FIG. 5E: 
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FIG. 5E 

In anodier dtemative a PS-2 "V conncctoi 13, equipped ^vith an intexnd aucomabc s^x;itch (not shown), is 
employed to petmit die simulianeous PS-2 connection of a k«y device 20 and a keyboaid 4^ (ot mouse 48) to a 
notebook compnter 10 as shown in FIG- 5E, In a similar alternative, the key device 20 is connected to the 
keyboard port 18 of a desktop computer 11 via a AT 'V conncctox 19, equipped with an internal automatic 
switch (not shown), ihst also permits the simultaneous connection of an AT keyboaird 47 as shown in FIG. 5F. 
(coL 5. lines 12-22) 

One might be tempted to argue that the circled items are the 'TIN entry device" and that 
these elements together read on claim 1 , However, even if the dxclcd elements receive a first message 
transmiUed from a host pTQoessing dmc^ addressed to a pin entry dmce according to a universal serial bus (USh) 
protocol^ and accept a PIN entered into the PIN entty device, they do not transmit a second message cotnprising at 
least a portion of the first message and the PIN from the PIN entry device to the token along a secure communication 
path. That is because the PIN is not transmitted to the token. 

For the foregoing reasons, the tejection of daim 1 is respectfully traversed. 

4. Claim 12 is Patentable Over die Rallis Reference 
Claim 12 recites: 

a PIN entry device^ comnsunicahlj; coifpleahle to a host processing dmce transmitting a first message 
addressed to the PIN entry device, and communicatively coupleable to the token according to a universal serial 
bus USB protocol, the PIN entry device comprising: 

a user input device, fi>r accepting a user-iTrfiut PIN; and 
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a processor, commurncativciy coupled to ihe us^ input device, the processor Jbr reedtdng the 
first message and combinirig the first message with the user-inputlPTN, and forprodudng a second message 
having at kast a potion of the first message and the us^r-4nput PIN 

Rflllis does not disclose a PIN entry device having a processor that receives the message and 
combitic$ it with a user-entered PIN to produce a second message. Accordingly, the rejection of 
claim 12 is traversed as welL 

5. Claijoci 18 is Patentable Over the Rallis Reference 
<^1<*tm 18 recites: 

yi method for securing a token from unauthori^d use, comprising: 
intercepting a first message from the host processing depice addressed to the token in a hub; 
providing the intercepted message to a PIN entry device cmnmunicativet^ coupled to the hub; 
accepting a second message from the PIN entry device comprising a user-entered PIN; 
generating a third message firm the second messa^^ the third message comprising the user-entered 
PIN and at least a portion of the first message; and 

transmitting U)t third message from the USB-compliant hub to the token. 

According to the First Office Action, the limitations of claim 18 were already discussed in 
the rejecdons of claims 1 and 3-4» but this is not the case. Nodiing in Rallis discloses intercepting a 
message fix>m a host processing device addressed to the token in a hub* RaJIis, in fact, fails to 
disclose intercepting any message, fails to disclose sending a message from a host processing device 
to a token, and fails to disclose a hub at aC. The First Office Action did not indicate which messages 
are die **second" and "third" messages described in die claim, and the Applicants can ascertain no 
such disclosure. Accordingly, the Applicants traversed the rejection of claim 1 8. 

The Final Office Action offers no further insiglit, except to say daat Rallis discloses 
transmitting messages that include die PIN^ and the ^^ub'^ was addressed in other claims. The 
Applicants ttavecse tliis rejection. 

6. Qaim 20 is Patentable Over die Rallis Reference 
Claim 20 recites: 
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a USB'CtmpIiant hub, commmicabfy coifpltabk betmcn a host pwmsing device and the token, the 
VSB comptimt htib having; 

means fir intempting a message addressed to the PIN entry dei/ice; 
means fir aerating a third message from the first message and a user-entered PIN; and 
means fir transmitting the third message to the token; 
a PIN entry device, commurumtivelj coupled to U SB-compliant hub,firaccepHng a user-entered 
FIN and providing the user-entered PIN to the VSB-compHant htd?. 

The First Office Action asserted chat Rallis inherendy discloses a USB-compKant hub, 
because it discloses a USB-compliaac port. 

The Apphcants responded that a U$B hub is not analogous to a USB port, and nothing in 
the Rallis reference indicates that a USB hub is necessarily present, as the law of "inherenc/* 
requires. Continental Can Co, v, Monsanto Co,, 948 F.2d 1264, 1269(Fed. Cit- 1991). The Applicants 
also pointed out that Rallis foils to disclose a PIN entry device. 

In finally rejecmig daim 3, the Exatniner again appears to argue that a USB port inhcrcntiy 
discloses a USB hub. On this issue, the Examiner and the Applicants will continue to disagree ... a 
USB port does not necessarily include a USB hub. 

The Final Office Action also provides "proof diat indicates a "system that has a usb port is 
a usb hub", citing the followiag portion of U.S. Patent 6,038,320, issued to MiQer: 

The computet 20, like the computer 10 in FIG- 1, inchidcs a CPU 12, a BIOS flash memoay 24 »nd a keyboard 
controller 18 coupled to a data/address bus 16. Furdier coupled to the daca/addxcss bus 16 is a USB controller 
26. The USB controller 26 is al«o coupled to a USB port 31 throu^ a USB 28. A USB hub 30 is phigged into 
the USB port 31 to allow more devices to be coupled to the USB 28 dirough USB port 31. The USB hub 30 
includes multiple USB ports 32, A USB keyboard 34 k plu^ into a USB port 32 of the USB hub 30. fcoL 1 
line 60 - col. 2, line 2) ^ 

Of course, the above passage, at best, discloses that a hub inherendy includes ^port, not that a 
^i?r/inherendy includes a hrrb. It is simply untrue that a system with a USB port necessarily includes a 
USB hub. 

The remaining features of claim 20 are likewise not disclosed by Rallis. Accordingly^ the 
rqecdon of claim 20 is ttaversed. 
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B, The Dependent Claims Are Patentable Over The Prior Art 

1 , Dependent Claim 2 is Patentable Over the Rallis Reference 

Claim 2 recites that the first message received tlie PIN entry device and die second 
message is transmitted from the PIN entry device direcdy to the token along die secure 
commimicarion path. The First Office Action rejected claim 2, based on die following portions of 
the Rallis reference: 

The user is prompted to connect the key device to ihe computet. In ihc prcfeired embodimenc, the user is 
prompted to enter a PIN. although the 5y«em can be configured to opcmtc withour manual PIN entrjr. (coL 1, 
UntjH 51-54) 



The procedure pennits cntty past the second sccurityr kvel only if tiic validation record is propedy decrypted, 
die installed hard disk serial number matches the decrypted number, and the manually-entered PIN matches 
the decrypted PIN- A failure at any step in the user-validatiDn procedure vsrill immediately power down the 
compuTer» thereby rendering it useless to a thief not possessing the required key device, (col. 1, lines 60-67) 



A program ninnbg on the notebook computer 10 uses the key device serial number and ihc encryprion key, 
along widi a Personal Identification Number (PIN), in a user-validation procedure to prevent operation (i e- 
po\(7er-up) of the note book computer 10 by an unaut!hoii2ed user. For ma»mum security protection, the key 
device 20 is conticcted only during die user-validation procedure and is carried and stored separately ficom die 
notebook computer 10. (coL 2,lines 52^56) 

Pkialy> the Rallis lefetencc does not teach translnitung a PIN to the token at all, let alone via 
a USB protocol. Accordingly, the Applicants traversed the rejection of claim 2. 

The Final Of&ce Action rejected r\€i\m 2 on the same basis as claim 1, and thtis provides no 
further insight regarding the rejection. Accordingly, the Applicants respectfully traverse this 
rejection. 



2. Dependent Claim 3 is Patentable Over the Rallis Reference 
Claim 3 recites that the step of receiving the first message ficom die host processing device 
and addressed to a PIN entry device comprises the steps of: 



and at 



and 
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nmving the first message in a USB-compliani hub commmicatmtf coitpkd to the host processing 
device via a first communication path; and 

transmitting the first messa^ to the PIN entry detdce communicative^ coupled to the USB- 
compSanthub 

and that the step of transmitting the second message cotnpiising a portion of the first message and 
the PIN and at least a pordon of the first message ftotsi the PIN enuy device to the token along a 
secure communication path comprises the step of: 

transmitting a second messa^ fiom the PIN entry detdce via the USB hub. 

As described above with respect to daim 20, RaUis does not disclose a USB hub. The 
rcmaimng features of daim 3, in terms of messages having particular information^ transmitted from 
one entity to another, are also not disclosed by RaUis, Accordingly, the rejection of claim 3 is 
improper and should be reversed. 

3. Dependent Claim 4 is Patentable Over the Rallis Reference 
Claim 4 recites that die step of tcansmitting the second message from the PIN entry device 
via the USB-compliant hub comprises the steps of: 

tnmsmitting a third message comprising the PIN fiom the PIN entry device to the USB-compSant 

hub; 

processing the message in the U SB-compliant hub to produce the second message; and 
transmitting the second messa^ from the USB-con^Uant hub> 

According to the First Office Action, the foregoing steps are disclosed as follows: 

A program that is aucomadcally invoked At computer pawci-up, or icsct, implements the usec-volidation 
procedure, The user is prompted (o Conncci the key de:vice to die computet- In die prefetred embodimenc, die 
usee is prompted to enter a PIN, aldiough the system can be configured to operate without inmiiial PIN entry. 
Hic procedure permits entry past a first security level only if the key device senal number ma-tches the 
uncnciyptcd numbers in die validadoo record. If the first-level validndon is successful, d^e procedure then utiles 
die enccypdon key to deciypt die hard drive serial number and PIN found in die stored validation recjord. Ihc 
procediuc permits entry past the second security level only if the vaHdadon record is propedy decrypted^ die 
installed hard disk serial number matches die decrypted number, and die maniwlly-entcred PIN matches the 
decrypted PIN. A feilure at any step in die user-validation procedure will immediately power down die 
computer, thertby icndering it useless to a diief not possessing the required key device. (coL 1, lines 49-67). 
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The Applicants tEavcrscd, as nothing in the foregoing text discloses transmitdng a third 
message compiising the PIN from the PIN entry device to a USB-compliant hub, processing the 
message in die hub to produce a second message, or transmitting the second message from tlie 
USB-compliant hvb. RaUis &ils to discloses a hub and teaches that the PIN is accepted in the 
notebook computer and is not transmitted anywhere else. 

The Final Office Action provided no further rationale for the rejection of claim 4, 



4. Dependent Claim 5 is Patentable Over the Rallis Reference 
Claim 5 recites the features of claim 1, and is patentable on the same basis. 

5. Dependent Claims 6, 7, 8, 9, 13, 15, and 22-23 are Patentable Over the Rallis 
Reference 

Claim 6 recites diat the first message (transmitted fcom a host processing device and 
addressed to a PIN entry device according to a USB protocol) is encrypted according to a first 
encryption key, and that the entry device comprises a decryption module having access to the first 
encryption key for decoding die first message. The First Office Action indicates that this was 
disclosed as follows; 

Briefly, a sccuniy system conscmcied in accotdance with the invention implcmentv a usci-valldatiOn proc&duic 
thai lequiies the user to connect the proper hardw;ixc "key" device to ^ computer at powcx-up to enable 
operadoA. The system can support multiple users and a single supervisor. Each authorized user is piovided 
with a. unique key device which is carded and stored separatdy Erom the computei:. The key device hokis a 
unique serial nun^ber and an encrypdon key, A validanon record stored on the computer's hard disk contains 
an unenciypced key device serial numbei, an encrypted hard disk serial number; and a Personal Identification 
Number QPJN) unique to ihe user. 

A program that is automaucally invoked at computer power-up, or xcijct, implements the uscr-validatioii 
procedure The user is prompted to connect Ac key device to the computer, In the prcfcired embodiment» the 
user is prompted to enter a PIN, althougli the system can be configured to Operate without manual PIN entry. 
The procedure permits entry past a fizst security levd only if the key device senal number matches the 
imcnciypted numbers in the validadon record- If the fixst-level vaUdadon is successful, the procedure dien uses 
the encrypdon key to decrypt the hard duve seiial number and PIN found in the stored validation record. The 
procedure permits entry past the second security level only if the validadon record ia properly decrypted, the 
installed hard disk serial number matches the decrypted number, and the manxially-euteted PIN matches the 
decrypted PIN. A failure at any step in the user-validadon procedure will immediately power down the 
computer^ thereby tendering it useless to a thief not possessing the scquixcd key device. (coL 1, lines 37-67) 
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The Applicants pointed out diac the foregoing does not teach a PIN entry device having a 
decryption modtile for decoding the first message. 
The Final Office Acrion answered: 

"Rallis discloses that there is a matching decrypted pin, dins die pin that is entered is 
encrypted. Further Rallis also discloses an encryption key that has a corresponding 
dec3ryption key (see coL 1, lines 49-64)" 

The cited portion of the Rallis reference is reproduced below: 

A program ihat is automfldcfllly invoked at computer power-\jp, or reset, implements the user- validation 
procedure. The user is prompted to connect the key device to the computer. In the preferred embodiment, the 
user is prompted to enter a PIN. although the system cim be configured to operate widiout manuni PIN entry. 
The procedure permits entry post a 5tst secuiir/ level onl/ ifthe key device setial number matches the 
unencrypted numbers in the validadon record. If the first-level vaEdation is successful, die procedure dien uses 
die encryption key to decrypt the hard drive serial number and PIN found in the stored validation record. The 
procedure permits entry past the second security Icvd only if the validadon record is properly decjypted, die 
installed hard disk scdal number matches the dectypted number, and the manually-entered PIN matches the 
deaypied PIN. A failure at any step in the user-vdidanon procedure will immediately power down the 
compttCet» dieieby tendering it useless to a thief not possessing the required key device 

The foregoing exerpt discloses the storage of an encrypted PIN in the laptop computer that 
is decrypted (by a program automatically invoked by the host computer at power-up) and compared 
to a PIN that is manually entered into the laptop computer. While this discloses a PINf and a 
decrypted PIN, it does not disclose the features of claim 6, namely, the encryption of a first message 
transmitted from a host processing device and addressed to a PIN entry device. 

Claim 13 is allowable for the same reasons. Claims 8 and 15 lilcewise recite decrypuon 
modules diat are not needed or employed in Rallis, Accordinfijfy, the Applicants respectfully traverse 
the rejection of claims 6, 8, 9, 13, and 15. 

6. Dependent Claims 10-11 are Patentable Over the Rallis Reference 
Claims 10 and 1 1 rcdrc the features of claim 1^ and are patentable on die same basis. 



-19^ 

G&C 30074.29-US-Il 



PAGE 22/23*RCVDATS/2S/2004 2:42:56 PM [Eastern DaylightM^ 



05-25-2004 10:56AM FROM-Gatas & Cooper LLP 



+13108418798 



T-556 P. 023/023 F-671 



7. Dfcpcaident Claims 14, 16» 17> 19, and 21 are Patentable Over die RaJlis 
Reference 

Claims 14, 16, and 17, and claims 19 and 21 redte the features of claims 12 and 18, 
respectively, and ate patentable on the same basis, 

VII. CONCLUSION 

In view of the above, it is submitted tliat this application is now in good order for allowance 
and such allowance is respectfully solicited Should the Examio-er believe minor matters still remain 
that can be resolved in a telephone interview, the Examiner is urged to call Applicants' undersigned 



attorney. 
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